doesn't this require the NAT to use the same inside<->outside address
binding for the connection between the client and the KDC as for
the connection between the client and the application server?
e.g. it seems like the NAT could easily change address bindings
during the lifetime of a ticket.
Correct. I think Greg was thinking only of NATs which share a single
global address among multiple clients on a private network...
- Bill